Phase 1 is down but phase 2 is up- test vpn phase 1 and 2

[MP18]

we have tunnel from PA  to vendor which is using Cisco ASA.

When there is no interesting traffic tunnel is down by design this part is ok.

but today i saw phase 1 as red and phase 2 as green on gui.

I did the 

test vpn ike command and phase 1 was green

but i was unable to ping across tunnel i see traffic going via tunnel but no replies.

Then i did

test vpn ipsec 

i was able to ping lan device at other end.

need to know when phase shows down then is it best practice to use the test command  for both phase 1 and 2?

when both phase 1 and 2 shows green and you can not ping across tunnel, you traffic going but no reply then should we use test command for phase 1 and  phase 2?

[BPry · Accepted solution]

@MP18,

Phase 1 doesn't need to show as active to still have a tunnel up and running. Essentially Phase 1 is just there to setup a secure channel for phase 2, and once that association has been made phase 1 doesn't matter. Therefore, Phase 1 can show as down and the tunnel will still be perfectly operational. 

I would honestly guess here that your issue is more to do with not having a tunnel-monitoring profile assigned to the tunnel, which means the PA might not notice if your ASA closes the tunnel due to inactivity. Which means you kind of have two options:

1) Apply a tunnel monitoring profile so your PA actually knows when the ASA side of the tunnel goes down. 

2) Configure the ASA so 'vpn-idle-timeout none' is present within the assigned group-policy attributes. 

[MP18]

we do not have tunnel monitoring setup as Cisco side is configured for tunnel down after 30 mins idle timeout.

Will ask Vendor to configure the  ASA so 'vpn-idle-timeout none